I talked to the support at the hosting company and they looked at the
system and said they couldn't see anything wrong with it - but they
can re-image it for me which normally costs a fee.
Is it worth re-imaging my system and re-installing everything?
I still have no idea what chkrootkit means when it says a port is
infected.
Adam

Hi,

Chkrootkit is known to fall for quite a few false positive, for
example if you run Portsentry or such anti-portscan demon, it also can
detect legitimate services like dhcpd or such as sniffers, which isn't
really incorrect but not a problem. I never heard of 2881 as being one
of those, but maybe getting in touch with the dev team could give you
an easy answer.

Maybe the only way to know for sure would be scanning all traffic from
another system regarding this port to see if anything suspicious can
be spotted, and maybe running an integrity check with debsum or such
on conf files, comparing the result with a backup from an earlier
state or a known sane system.

What would really be interesting is to spot the precise day when the
warning first occurred from your system logs, and see if you can spot
any change in configuration that could have triggered it (update ?).
That is, if your system really is infected you cannot trust anything
and especially not the logs...